a3e5d49dfadef61c3a416f135e8f24ad76fb1a538d7a914341d26141b33bd97b

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261020-pyrlsshv81
SHA256 a3e5d49dfadef61c3a416f135e8f24ad76fb1a538d7a914341d26141b33bd97b
MD5 9335cb6ffa476f3dada21210c709778b
SHA1 d99d697e321f0f19355482780f97d2bc2f7e1cbb
SHA512 053cf7ae2b2e60f733d0e99d13609be677517d921ee0c949151abda1ecc9d6e8425025eaf86b8c57cb72a5268abf0ce86b862da1d268fb86db7919308e2a2e61
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T1B834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4724	CP.exe
1740	tnlgaysqki.exe
4344	CP.exe
4816	CP.exe
2428	i_tnlgaysqki.exe
1328	kidavtnlfd.sys
2440	CP.exe
5052	axsqkicavs.exe
2592	CP.exe
3468	CP.exe
3792	i_axsqkicavs.exe
5080	pnhfaxspki.sys
1400	CP.exe
3176	fcxupnhfxs.exe
2736	CP.exe
2976	CP.exe
5008	i_fcxupnhfxs.exe
1564	hfzxspkica.sys
4628	CP.exe
1668	pmhezxrpjh.exe
4200	CP.exe
400	CP.exe
816	i_pmhezxrpjh.exe
4188	urmkecwupm.sys
1460	CP.exe
4892	mhfzxrpjhc.exe
1076	CP.exe
1388	CP.exe
4356	i_mhfzxrpjhc.exe
4440	hbztrmjecw.sys
2340	CP.exe
1296	wrojhbztrl.exe
2128	CP.exe
2172	CP.exe
2640	i_wrojhbztrl.exe
1472	rljebwtomg.sys
2068	CP.exe
2268	gbytrljdbw.exe
4636	CP.exe
4540	CP.exe
1736	i_gbytrljdbw.exe
3124	lgbytrljdb.sys
4176	CP.exe
1892	tnlgdywqoi.exe
2768	CP.exe
3768	CP.exe
3156	i_tnlgdywqoi.exe
4508	vtnlgdywqo.sys
2364	CP.exe
4372	oidbvtnlgd.exe
2808	CP.exe
3504	CP.exe
3136	i_oidbvtnlgd.exe
2124	idavtnlfdy.sys
4368	CP.exe
1072	xsqkicavsn.exe
3352	CP.exe
4880	CP.exe
212	i_xsqkicavsn.exe
868	vsnkfdxvpn.sys
3600	CP.exe
1084	nhfaxsqkic.exe
3432	CP.exe
916	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxupnhfxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxupnhfxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oidbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oidbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoidbvt.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4544	ipconfig.exe
3276	ipconfig.exe
1564	ipconfig.exe
4884	ipconfig.exe
620	ipconfig.exe
4916	ipconfig.exe
2356	ipconfig.exe
936	ipconfig.exe
1848	ipconfig.exe
4604	ipconfig.exe
872	ipconfig.exe
552	ipconfig.exe
4316	ipconfig.exe
2796	ipconfig.exe
4228	ipconfig.exe
5080	ipconfig.exe
1052	ipconfig.exe
2712	ipconfig.exe
3496	ipconfig.exe
3988	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3645168735"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000838c765fc5677a49bc2c0d1578ce33c300000000020000000000106600000001000020000000865efc88beb1c566ed0ff1154f2dd3ef71892cda8f51202182bec74f751f85b2000000000e8000000002000020000000b2b237eea9623eefb1d4cd0da4a42b2f86049a0a7c2fc085462697fa034361d320000000430119653c77cda0bf5c1a176153f45d747d2b2f9c552d86e294ebd6e434bdf840000000a0d670c9aac7be84ad639fa58bad4e1ce826cfde87655a2a00be05246e14ae021f3565055c04da8bd11e7c2ba847b3f727e0d91ad4948486375229f8534be84c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3639543686"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31285392"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40682e3c9960dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31285392"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000838c765fc5677a49bc2c0d1578ce33c3000000000200000000001066000000010000200000003f45f59b5ba434ee29a452dca7f6ab68487ec722c0539543c8526cb46f037658000000000e800000000200002000000067b4bb57c4601171eb3a25619b9037ee2dc18d146df4d7bcb4593ae9c51fdb28200000004a6a2a085e2b3a096c41e0b2f5a4615c793e74df8ddb7fb8ba614d1c4549afe44000000073f82c298f41394b4ea5883ed65b8feb476f26b0580ea8d4570855af1ad542b236d810d202ed8c6f2e7335499dbe77f94cd2f3a85747808910bcb3680da9c9cc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0442BA9B-CC84-11F1-A0CA-66DCEFAAD7CC} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "499265256"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3005383c9960dd01	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	i_tnlgaysqki.exe
Token: SeDebugPrivilege	3792	i_axsqkicavs.exe
Token: SeDebugPrivilege	5008	i_fcxupnhfxs.exe
Token: SeDebugPrivilege	816	i_pmhezxrpjh.exe
Token: SeDebugPrivilege	4356	i_mhfzxrpjhc.exe
Token: SeDebugPrivilege	2640	i_wrojhbztrl.exe
Token: SeDebugPrivilege	1736	i_gbytrljdbw.exe
Token: SeDebugPrivilege	3156	i_tnlgdywqoi.exe
Token: SeDebugPrivilege	3136	i_oidbvtnlgd.exe
Token: SeDebugPrivilege	212	i_xsqkicavsn.exe
Token: SeDebugPrivilege	808	i_nhfaxsqkic.exe
Token: SeDebugPrivilege	1228	i_causmkecxu.exe
Token: SeDebugPrivilege	2452	i_mhfzxrpkhc.exe
Token: SeDebugPrivilege	1872	i_cwuomhezxr.exe
Token: SeDebugPrivilege	3764	i_trmgeywqoj.exe
Token: SeDebugPrivilege	4452	i_bytqljdbvt.exe
Token: SeDebugPrivilege	3376	i_dywqoidbvt.exe
Token: SeDebugPrivilege	2760	i_vtnlfdyvqo.exe
Token: SeDebugPrivilege	1164	i_nlfdxvpnif.exe
Token: SeDebugPrivilege	4884	i_cxupnhfzxs.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3492	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3492	iexplore.exe
3492	iexplore.exe
3420	IEXPLORE.EXE
3420	IEXPLORE.EXE
3420	IEXPLORE.EXE
3420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 3492	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	85
PID 3492 wrote to memory of 3420	3492	iexplore.exe	86
PID 2240 wrote to memory of 4724	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 1740 wrote to memory of 4344	1740	tnlgaysqki.exe	90
PID 2240 wrote to memory of 4816	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	97
PID 2240 wrote to memory of 2440	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 5052 wrote to memory of 2592	5052	axsqkicavs.exe	104
PID 2240 wrote to memory of 3468	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	109
PID 2240 wrote to memory of 1400	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	113
PID 3176 wrote to memory of 2736	3176	fcxupnhfxs.exe	115
PID 2240 wrote to memory of 2976	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 2240 wrote to memory of 4628	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 1668 wrote to memory of 4200	1668	pmhezxrpjh.exe	124
PID 2240 wrote to memory of 400	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 2240 wrote to memory of 1460	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 4892 wrote to memory of 1076	4892	mhfzxrpjhc.exe	134
PID 2240 wrote to memory of 1388	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 2240 wrote to memory of 2340	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 1296 wrote to memory of 2128	1296	wrojhbztrl.exe	144
PID 2240 wrote to memory of 2172	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	147
PID 2240 wrote to memory of 2068	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 2268 wrote to memory of 4636	2268	gbytrljdbw.exe	153
PID 2240 wrote to memory of 4540	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 2240 wrote to memory of 4176	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 1892 wrote to memory of 2768	1892	tnlgdywqoi.exe	162
PID 2240 wrote to memory of 3768	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 2240 wrote to memory of 2364	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 4372 wrote to memory of 2808	4372	oidbvtnlgd.exe	171
PID 2240 wrote to memory of 3504	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 2240 wrote to memory of 4368	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 1072 wrote to memory of 3352	1072	xsqkicavsn.exe	180
PID 2240 wrote to memory of 4880	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 2240 wrote to memory of 3600	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	187
PID 1084 wrote to memory of 3432	1084	nhfaxsqkic.exe	189
PID 2240 wrote to memory of 916	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	192
PID 2240 wrote to memory of 1772	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	196
PID 2556 wrote to memory of 5096	2556	causmkecxu.exe	198
PID 2240 wrote to memory of 392	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	201
PID 2240 wrote to memory of 1028	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	205
PID 4692 wrote to memory of 4840	4692	mhfzxrpkhc.exe	207
PID 2240 wrote to memory of 2304	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	210
PID 2240 wrote to memory of 4916	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	214
PID 1688 wrote to memory of 2648	1688	cwuomhezxr.exe	216
PID 2240 wrote to memory of 2320	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	219
PID 2240 wrote to memory of 1176	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	223
PID 2752 wrote to memory of 3708	2752	trmgeywqoj.exe	225
PID 2240 wrote to memory of 3208	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	228
PID 2240 wrote to memory of 1472	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	232
PID 2972 wrote to memory of 4760	2972	bytqljdbvt.exe	234
PID 2240 wrote to memory of 664	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	237
PID 2240 wrote to memory of 2944	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	241
PID 3780 wrote to memory of 2216	3780	dywqoidbvt.exe	243
PID 2240 wrote to memory of 4172	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	246
PID 2240 wrote to memory of 804	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	250
PID 4088 wrote to memory of 2284	4088	vtnlfdyvqo.exe	252
PID 2240 wrote to memory of 2356	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	255
PID 2240 wrote to memory of 3788	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	259
PID 1672 wrote to memory of 552	1672	nlfdxvpnif.exe	261
PID 2240 wrote to memory of 1516	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	264
PID 2240 wrote to memory of 2124	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	268
PID 2464 wrote to memory of 4500	2464	cxupnhfzxs.exe	270
PID 2240 wrote to memory of 4264	2240	2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe	273

C:\Users\Admin\AppData\Local\Temp\2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-19_9335cb6ffa476f3dada21210c709778b_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3492 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlgaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4724
- - C:\Temp\tnlgaysqki.exe
    C:\Temp\tnlgaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlgaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4816
- - C:\Temp\i_tnlgaysqki.exe
    C:\Temp\i_tnlgaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkicavs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2440
- - C:\Temp\axsqkicavs.exe
    C:\Temp\axsqkicavs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkicavs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3468
- - C:\Temp\i_axsqkicavs.exe
    C:\Temp\i_axsqkicavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxupnhfxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1400
- - C:\Temp\fcxupnhfxs.exe
    C:\Temp\fcxupnhfxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2736
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxupnhfxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2976
- - C:\Temp\i_fcxupnhfxs.exe
    C:\Temp\i_fcxupnhfxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhezxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4628
- - C:\Temp\pmhezxrpjh.exe
    C:\Temp\pmhezxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhezxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:400
- - C:\Temp\i_pmhezxrpjh.exe
    C:\Temp\i_pmhezxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpjhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1460
- - C:\Temp\mhfzxrpjhc.exe
    C:\Temp\mhfzxrpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1388
- - C:\Temp\i_mhfzxrpjhc.exe
    C:\Temp\i_mhfzxrpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhbztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2340
- - C:\Temp\wrojhbztrl.exe
    C:\Temp\wrojhbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhbztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2172
- - C:\Temp\i_wrojhbztrl.exe
    C:\Temp\i_wrojhbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytrljdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2068
- - C:\Temp\gbytrljdbw.exe
    C:\Temp\gbytrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytrljdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4540
- - C:\Temp\i_gbytrljdbw.exe
    C:\Temp\i_gbytrljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlgdywqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4176
- - C:\Temp\tnlgdywqoi.exe
    C:\Temp\tnlgdywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlgdywqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3768
- - C:\Temp\i_tnlgdywqoi.exe
    C:\Temp\i_tnlgdywqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oidbvtnlgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2364
- - C:\Temp\oidbvtnlgd.exe
    C:\Temp\oidbvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oidbvtnlgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3504
- - C:\Temp\i_oidbvtnlgd.exe
    C:\Temp\i_oidbvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsqkicavsn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4368
- - C:\Temp\xsqkicavsn.exe
    C:\Temp\xsqkicavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsqkicavsn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4880
- - C:\Temp\i_xsqkicavsn.exe
    C:\Temp\i_xsqkicavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfaxsqkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3600
- - C:\Temp\nhfaxsqkic.exe
    C:\Temp\nhfaxsqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfaxsqkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:916
- - C:\Temp\i_nhfaxsqkic.exe
    C:\Temp\i_nhfaxsqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkecxu.exe ups_run
  2⤵
  PID:1772
- - C:\Temp\causmkecxu.exe
    C:\Temp\causmkecxu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkecxu.exe ups_ins
  2⤵
  PID:392
- - C:\Temp\i_causmkecxu.exe
    C:\Temp\i_causmkecxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpkhc.exe ups_run
  2⤵
  PID:1028
- - C:\Temp\mhfzxrpkhc.exe
    C:\Temp\mhfzxrpkhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpkhc.exe ups_ins
  2⤵
  PID:2304
- - C:\Temp\i_mhfzxrpkhc.exe
    C:\Temp\i_mhfzxrpkhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomhezxr.exe ups_run
  2⤵
  PID:4916
- - C:\Temp\cwuomhezxr.exe
    C:\Temp\cwuomhezxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomhezxr.exe ups_ins
  2⤵
  PID:2320
- - C:\Temp\i_cwuomhezxr.exe
    C:\Temp\i_cwuomhezxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmgeywqoj.exe ups_run
  2⤵
  PID:1176
- - C:\Temp\trmgeywqoj.exe
    C:\Temp\trmgeywqoj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmgeywqoj.exe ups_ins
  2⤵
  PID:3208
- - C:\Temp\i_trmgeywqoj.exe
    C:\Temp\i_trmgeywqoj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqljdbvt.exe ups_run
  2⤵
  PID:1472
- - C:\Temp\bytqljdbvt.exe
    C:\Temp\bytqljdbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytqljdbvt.exe ups_ins
  2⤵
  PID:664
- - C:\Temp\i_bytqljdbvt.exe
    C:\Temp\i_bytqljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dywqoidbvt.exe ups_run
  2⤵
  PID:2944
- - C:\Temp\dywqoidbvt.exe
    C:\Temp\dywqoidbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dywqoidbvt.exe ups_ins
  2⤵
  PID:4172
- - C:\Temp\i_dywqoidbvt.exe
    C:\Temp\i_dywqoidbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqo.exe ups_run
  2⤵
  PID:804
- - C:\Temp\vtnlfdyvqo.exe
    C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2284
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
  2⤵
  PID:2356
- - C:\Temp\i_vtnlfdyvqo.exe
    C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvpnif.exe ups_run
  2⤵
  PID:3788
- - C:\Temp\nlfdxvpnif.exe
    C:\Temp\nlfdxvpnif.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvpnif.exe ups_ins
  2⤵
  PID:1516
- - C:\Temp\i_nlfdxvpnif.exe
    C:\Temp\i_nlfdxvpnif.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxupnhfzxs.exe ups_run
  2⤵
  PID:2124
- - C:\Temp\cxupnhfzxs.exe
    C:\Temp\cxupnhfzxs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxupnhfzxs.exe ups_ins
  2⤵
  PID:4264
- - C:\Temp\i_cxupnhfzxs.exe
    C:\Temp\i_cxupnhfzxs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4884

C:\Temp\kidavtnlfd.sys
C:\Temp\kidavtnlfd.sys
1⤵
- Executes dropped EXE
PID:1328

C:\Temp\pnhfaxspki.sys
C:\Temp\pnhfaxspki.sys
1⤵
- Executes dropped EXE
PID:5080

C:\Temp\hfzxspkica.sys
C:\Temp\hfzxspkica.sys
1⤵
- Executes dropped EXE
PID:1564

C:\Temp\urmkecwupm.sys
C:\Temp\urmkecwupm.sys
1⤵
- Executes dropped EXE
PID:4188

C:\Temp\hbztrmjecw.sys
C:\Temp\hbztrmjecw.sys
1⤵
- Executes dropped EXE
PID:4440

C:\Temp\rljebwtomg.sys
C:\Temp\rljebwtomg.sys
1⤵
- Executes dropped EXE
PID:1472

C:\Temp\lgbytrljdb.sys
C:\Temp\lgbytrljdb.sys
1⤵
- Executes dropped EXE
PID:3124

C:\Temp\vtnlgdywqo.sys
C:\Temp\vtnlgdywqo.sys
1⤵
- Executes dropped EXE
PID:4508

C:\Temp\idavtnlfdy.sys
C:\Temp\idavtnlfdy.sys
1⤵
- Executes dropped EXE
PID:2124

C:\Temp\vsnkfdxvpn.sys
C:\Temp\vsnkfdxvpn.sys
1⤵
- Executes dropped EXE
PID:868

C:\Temp\vpnhfaxspk.sys
C:\Temp\vpnhfaxspk.sys
1⤵
PID:176

C:\Temp\usmkecxupn.sys
C:\Temp\usmkecxupn.sys
1⤵
PID:804

C:\Temp\jecwuomgez.sys
C:\Temp\jecwuomgez.sys
1⤵
PID:1664

C:\Temp\eywrojhbzt.sys
C:\Temp\eywrojhbzt.sys
1⤵
PID:2428

C:\Temp\dbwuomgeyw.sys
C:\Temp\dbwuomgeyw.sys
1⤵
PID:212

C:\Temp\ljdbvtolge.sys
C:\Temp\ljdbvtolge.sys
1⤵
PID:2536

C:\Temp\davtnlfdxv.sys
C:\Temp\davtnlfdxv.sys
1⤵
PID:1764

C:\Temp\xsqkicavsn.sys
C:\Temp\xsqkicavsn.sys
1⤵
PID:2452

C:\Temp\vpnhfaxsqk.sys
C:\Temp\vpnhfaxsqk.sys
1⤵
PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqkicavs.exe

Path C:\Temp\axsqkicavs.exe
Size 226KB
SHA256 a232d5ea9fd465cc44db3d55572fab7de3ebd97d5c444d5aea1bb1296c7fbb28
MD5 191ad10a199f9dad12d2e954a25c4785
SHA1 61e3f918f6bb81b85a3e69b9a0eb52688ff567ed
SHA512 09834bf6d52cabd31cca33c99926b39e9ba63108367fafd29af76a444caba775959969bedbb59e63f8ab87a3f709dd273a6241948cbe156ab0793eebb06e6ab9
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T18534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxupnhfxs.exe

Path C:\Temp\fcxupnhfxs.exe
Size 226KB
SHA256 6a562ec9ac2fc8b363cc4eed4d34b745c1b3f2fefd3d26122948332432ebf5a0
MD5 df7028e8019eb8b482ceac66eda81474
SHA1 19912b1723a7c976687528de6724e586a39a12ce
SHA512 666d479383e23032c64022cb19c11b61afaede91f0586ac2bf9744245eb6a7bdc75044510c9794ce73938927616bff374eea0e39207d7e2dfac67e2f46b3e922
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T17034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbw.exe

Path C:\Temp\gbytrljdbw.exe
Size 226KB
SHA256 d8eea71939e6ee4bee78ddff687d5b3761266c4941772c25f70ecf3914c1e57d
MD5 8edab486077be37ae0f606bfc46b6f8e
SHA1 a827f6c60197900d625000dadd9e86f49c3742bd
SHA512 8ffef109a220b0b0acb10cfe47461aa80ea3d8fb6a326af24180dc70e3aaceebe24df1ed202ea2c5dc1ab10f8011a29e6b66db894732586e38c147c7655652a9
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T19534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrmjecw.sys

Path C:\Temp\hbztrmjecw.sys
Size 141KB
SHA256 344d76c85d7ddf03a5a44984185032117d5f586269ab6396d07f52036ad0003a
MD5 c208e583fa8355848a58ccbae1b56cce
SHA1 4d051b928d43212d89a1a5dffffed204cf9ba86d
SHA512 c11ddf3b8c54c887cf4db0efd9421e45edf94a0287473da0da45852973e948a9f1d29dc249a7a27f61382035598c25085a444b12ec4528f45147b9488274a6a3
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1ADE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxspkica.sys

Path C:\Temp\hfzxspkica.sys
Size 141KB
SHA256 31aa735d2c5772a5fd3639442360d418df0e66bb63a853912456a23abb39649c
MD5 5e6d0979a4f56b784cfe4333368d3e0f
SHA1 d7836352324ba325db498be011d39099b7957c77
SHA512 983698b9326cb15ef91c6be01476330cf422dfd09de1bbc94a5cb4d3963260172a134e4c3ebe0be455d820b41719760e90493e806ee646a68ccb3913c3a2dcdb
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T177E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axsqkicavs.exe

Path C:\Temp\i_axsqkicavs.exe
Size 226KB
SHA256 d737ee0f42e957193cd899fb8ce7b4f9192ad3c1a32a5391b59829d40c1a7815
MD5 c5f99be2915408cfbef5ef3c2342a24e
SHA1 e40436b2b1bcf1f10030e80b416c06af3a32b9be
SHA512 d084ef73d9a10dba6f59b3627c578485dce50c5a11ed8b33e859d4ab0a44daae5da415bb892de65c6a50bc01704757e484b27b12cbb71aa108ab2ce8d8d4d8b6
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T1CB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcxupnhfxs.exe

Path C:\Temp\i_fcxupnhfxs.exe
Size 226KB
SHA256 abc75e4c08e9fa5e406a1df41ebf7bfd3e3ba4409c66adc7de9df512a336fe07
MD5 e216744710b9d45ee63abee7e5a6577e
SHA1 9050cb691fa15270cded6aba8a039dff236b5be3
SHA512 ef41e0f7b27a4ce8f6c27244b0c5d381fe93c7b9dd7e3bd826661c0cbe705122b3892ec1813939588eec919947487324a8c6bca6d2bf5a6aeb97c337bd30708d
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T1E434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytrljdbw.exe

Path C:\Temp\i_gbytrljdbw.exe
Size 226KB
SHA256 8e55e6b1573fdf52e55b5a12fb885acddda1b52d8fee61a8bc4228c3ad015d0a
MD5 ed2d2a1dfab489f2b5f324975b6ae485
SHA1 71f16645f188ed69db18039e01f26d15bdd2d973
SHA512 f68bad60c9580ba2d26342924b5bbf8e888d932aae7c4c9b04f7433884f34089aa63ed3673c96b06db864c098d61d67d9b6dcecfc160cc91f2989044d2adfaf8
SSDEEP 3072:GGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:9XY4LK+a3lLNngoqRttA7
TLSH
T1DA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhfzxrpjhc.exe

Path C:\Temp\i_mhfzxrpjhc.exe
Size 226KB
SHA256 7ef7d8f08d1b1d11536e49e0ab37e52e3d9c8d7418c79dfd0b8550486b24f008
MD5 87163f495bbc861297d3596571c3e904
SHA1 6d70250878884dfb3834b2400998a1897a4c88fc
SHA512 8dc02b05b57630b88567e5eb033ca31cf6fcef5c1cd1cc7a4928b8065f998fb17c8a91a9c492a1451efb9f35a166ae9746da90a27309f16a92bbe194f814250e
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T17334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmhezxrpjh.exe

Path C:\Temp\i_pmhezxrpjh.exe
Size 226KB
SHA256 689d6ce205849ee99b15abdd8f638a494ed5a79c2692eca8d61b98c26a39454f
MD5 80940c10bf71b7fb9d3fd11ff0985c22
SHA1 9c54876e6220efc5f53c49f50e8ddbea6fe9ef1d
SHA512 2c28686d1ad1161dee7c669058200dc0a9ce7b76f4f1bcfa791ae077b9428013bfdb25fc459071bee4b37d5e6b6c54420d0640f3b46ebee34f652d35fb8e43f6
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T1BA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlgaysqki.exe

Path C:\Temp\i_tnlgaysqki.exe
Size 226KB
SHA256 f62230e1f447b76de6697c033300742b2c0b585c7cfc26b37b03d70dd339e001
MD5 eceaa63e4f634aeb74fc4108e68b624f
SHA1 3aa30d59da17bfa9d46c98a51ae0ca118b77f80a
SHA512 d1275cec7d5035d6359eaaf13a8a0d277db9998805abebb5ad6625a3a6bfd8efacf3c9e644dfd005efd0861f7e37f6c22cfcfa08c12daa22e37a620d47d5a28b
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T16E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojhbztrl.exe

Path C:\Temp\i_wrojhbztrl.exe
Size 226KB
SHA256 1455c8707698e6db3ae82debde521a79003c8aff81a8d6b944217f30a30dd4c0
MD5 fd053517fee193f2b6c42e91c8c1fe1a
SHA1 cac1486d89a0035218659c533dd899b9fa2fdbb8
SHA512 c5c0d6fbfbd272d72d2eb88b9e0dfc643828c04949476cb46e7971b62793cbc5d53e23330d0503a3c87120ba0531259277b78c1e6b399d7f44824be32f5f5f83
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T11E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kidavtnlfd.sys

Path C:\Temp\kidavtnlfd.sys
Size 141KB
SHA256 3bfd22ba99ea79e326bc4fcc1bdbf88fe8075971816012d08a4d523b4549816b
MD5 613630439111712aba8f3261d6c5fef4
SHA1 3e6b25a782d1841e5463a00cef5799b4fefc4333
SHA512 147f81e389e934b1a37abd04ebda6786900be5a35005b25160ce818f2fefe6776b51ac86205308fdd64a5b6bbd755a55d3c8919061be2a0da0f093cb9efbd1ec
SSDEEP 1536:ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T145E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgbytrljdb.sys

Path C:\Temp\lgbytrljdb.sys
Size 141KB
SHA256 ba0c06ec8000f415ce7ee018cf8cc648dd3391dc08bf3bd7758d2a15c4c70383
MD5 08affb0955bbc5a10502c787815d6904
SHA1 8efbdceb2fb72dc9923e31f07d233a99d114243b
SHA512 4e29efe45c6c6b5e221195c03270f0b65d6047ee3a1749f78bbc38f12edc38cfec6dfc73d00334e500e47e547e04c72251005aba570c135b9fd0abaacf64170d
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F6E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfzxrpjhc.exe

Path C:\Temp\mhfzxrpjhc.exe
Size 226KB
SHA256 ba4963dc929dd773fbc29900bdb26185c98a4ce995ca7e80bbe8067e8b7911e0
MD5 1aee1724926f1a3f2a57aba0ff834add
SHA1 a8a94d41521e7abc478970e28e258b5ae3cc3470
SHA512 a8d5e874e509473135d1be7037f7e69aa790b19e89fae12d0ae82f5568c84e69e5ff9e38cb9076ed76f16505335676a0f77bc58f5c558482342d83a22963719d
SSDEEP 3072:AGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:nXY4LK+a3lLNngoqRttA7
TLSH
T16434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhezxrpjh.exe

Path C:\Temp\pmhezxrpjh.exe
Size 226KB
SHA256 42b5107f4e417e216dadb299f7c937250d5a5f94794f5bf21db8a298c3dc0ad8
MD5 2db85536b8763c41708ba0a37cdac6cb
SHA1 582a1c30a175b1f904a08e851da5b096587223e1
SHA512 bc37d90d2f923fa880457b43f4d49ba0affac76030d85ffdb27be5061ad5a21be80402a73c9530b3fa3e4497f7c2d400efb0d24a49e8594c60cd36649af7c0f4
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T14B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfaxspki.sys

Path C:\Temp\pnhfaxspki.sys
Size 141KB
SHA256 14c7d37c73c6ccdbf4396f7ebfbb0c611b87ac344fb7288e702c0eda93411da3
MD5 32fb70a0b79b0a8f934ee181a251a4b9
SHA1 2d232591a078123634fb06c7db7ef1a7cd890037
SHA512 5557503e15c5722a6235c40d48538e8f1e875da91a008dc5a1157832efc2032fbe8d1a967ee491924b77f2c52eea70800f2a2baf83882a10ebc2adb024331390
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16AE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebwtomg.sys

Path C:\Temp\rljebwtomg.sys
Size 141KB
SHA256 8bdf26f900cf5f5cbb86fe0b1f1d02b3a137c5338abbfca70b81075ee789a945
MD5 6314c2f4c0cc531c7b4f78a9ee02396a
SHA1 211092a5abbb4c05744f7cc081a30c3f744372e4
SHA512 e3199e17df1746bdd4289e78337ad5a2831ac422f4fc540fb8e4beb8f04e1624939dc9e2669344c1448d12cd047e304564926a41a2b87f20bd6db8e89cb06924
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T112E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgaysqki.exe

Path C:\Temp\tnlgaysqki.exe
Size 226KB
SHA256 715ce648563e92b846e795184df86ec9a51d5bce02503157f9d93728b6c7cb5d
MD5 9f5a502fd65bcf38da1018109dfa5228
SHA1 db17707b21422fef56d7f4da08ba154604470882
SHA512 9af1d63ff0ad9a95ac769fff58ce755fd82115f29117ebc8fef29e979550940d007e11b3b8dae50581e4981544f5272fad9d2ae51b32570d46d05ab822851281
SSDEEP 3072:U5QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e5:AXY4LK+a3lLNngoqRttA7
TLSH
T17C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdywqoi.exe

Path C:\Temp\tnlgdywqoi.exe
Size 226KB
SHA256 ed874f64e6d31f8b77cfe2ab77ac07fc3b5973c5dbaf00ddc09b137d14de46f6
MD5 b9c4cb25a01816c73f8a51dda341a23f
SHA1 aa2de63e377058baaf8f70c8e0b6081449625017
SHA512 bd2027d3d41c4dfcdefb617232de5c5e2a464da8e09c43423f306281ba46f9c427b32793775328e0389bc55eb3e2568b8e4e3d44fa9b047e5ef867b09f7dc0c4
SSDEEP 3072:AGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:nXY4LK+a3lLNngoqRttA7
TLSH
T16934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwupm.sys

Path C:\Temp\urmkecwupm.sys
Size 141KB
SHA256 8542f8fafb66b0eb1ee74803a17d72cd85a48793a390769e6aeaa48e94d3e423
MD5 f3b28259488e28efc50b06187ee9db9d
SHA1 e7360a0612ce91cadb64c5cdc0b73f7060c9f112
SHA512 6db0bb4d982fbcb2f26ceda040bf359cb4277cf830b4f13be4d837949ff198207ab8467bd85f36ed8ac92d67b7a2bbbeff5fc569799a72cda77b5155f8012df6
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T159E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbztrl.exe

Path C:\Temp\wrojhbztrl.exe
Size 226KB
SHA256 183f768720fcacf328ac00bf09ea8bf32126b34ce5abf0aa984a7b7e35c9eb20
MD5 0c867dfe18d83129b8c88fb20dcbb8b4
SHA1 5701797bd73814f19f8a92d5be167cb4cfb8ca00
SHA512 b7f55881e67a6e776787d4a932f947ea27242eb5e6d9926da565a9629e3a4a2b1b1e7c35df9e9b54624868bf6a2cf5ec24f7a8d498548e31ef3aedd74975a7fc
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T1C334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 de15690098c2a08fa758fe615bf61d0210402f631c742091292ff542c77b09ef
MD5 9caafc85178d40034a04827b817907f9
SHA1 27f52d4ebc4f8baf9084805b9a0c2c9393a0ac37
SHA512 b929a9de5fe2ee594387aeee1c59265a7e67122ac7560b1a3a201846b7b75e9725674bb4739dcf811999287b33b45f5120c1d2cc6aa71156f00e5177301b2af2
TLSH
T167F09E9194B9B8A1BA8165DC2FD40B9C302190BB0444D151E9B8C6E104A4A767D3A13A
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 d907ac4fde8baf63049b7beb0bcafef15ce0a48b2eda1a4140a2434c0cd021ba
MD5 0b57e02637e9535d47c835f6b4e0af5b
SHA1 4fbb943522e5f5d77ab0e4b9034c68db8f68fb80
SHA512 95de49256903772dc2f25a29b54d8b7dccf1d65f4d47f9b131704cdd9e8d7dd5d2c53251269e1e3cc057521482ea4c7309a2d3064ea5d327165f516059174d87
TLSH
T14BE0C02422FE421EF2E4E0744BC5B52645A9F0270418A3B46BC55F08B702E009D03F29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5FBHLEWR\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/176-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/212-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/804-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/868-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/868-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1328-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1472-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1564-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1664-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1764-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2124-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2428-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2452-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2476-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2536-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3124-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4188-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4440-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4508-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5080-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads